No, the "nefarious" means they are simply using APIs like WriteProcessMemory/ VirtualProtectEx/CreateRemoteThreadEx to modify the memory of runing programs or use SetWindowsHookEx to install global hooks (which inject your dll into every process for the non low-level events)